Contact usGet started

AI product guidance

Vertex AI Agent Builder governance guidance

How to govern Vertex AI Agent Builder and the agents teams build and run on Google Cloud, with guidance for executives, risk teams and IT.

How should an organisation govern Vertex AI Agent Builder?

Vertex AI Agent Builder pays off when agents are governed as an ongoing practice rather than approved once and left to run. Three things matter whatever the role. The first is knowing every agent in use, what it can reach and who is accountable for it. The second is keeping limits, assessments and controls in step as agents gain tools, connections and independence. The third is being able to show, at any time, how each agent was approved and that its controls held. Organisations that get these right can hand agents more of the work, with confidence rather than caution.

Reviewed 3 October 2026. Aicura is not affiliated with Google.

About Vertex AI Agent Builder

Vertex AI Agent Builder is Google’s platform for building, deploying and running AI agents in the organisation’s own Google Cloud environment. Teams build agents in code or visually, host them on a managed runtime and connect them to tools, MCP servers, other agents and business systems. Agents can keep session history and long-term memory about the people they serve, and they act through whatever tools they are granted. Its reach grows with every agent, tool and connection added, so good governance lets the organisation build with confidence and keep oversight in step as the agent estate grows.

Where governance makes the difference

  • Agents acting at scale without a person in the loop. Agents run within the policies they are given and act on their own between reviews. Without clear limits on tools and actions, a misjudged decision can repeat across many customers or records before anyone notices.
  • Content steering an agent’s actions. Agents read user input and tool responses and then call further tools. Instructions hidden in that content can push an agent towards actions or disclosures nobody intended.
  • Personal information gathering in memory and records. Agents can hold what they learn about people across conversations, and detailed tracing can capture prompts and responses. Without deliberate decisions, sensitive information can be kept longer and seen more widely than intended.

For the executive team

Agents act on the organisation’s behalf

Agents built on Vertex AI Agent Builder do more than answer questions. They carry out tasks, make operational decisions and deal directly with customers and staff. That makes each agent closer to a new member of the workforce than a piece of software, and it needs a named person accountable for what it does.

The platform supplies controls but the organisation sets them

Vertex AI Agent Builder offers ways to limit what agents can reach, screen what they read and record what they do. None of that helps until someone decides the limits, applies them to each agent and checks that they hold. The value comes from treating those decisions as part of approving every agent.

Oversight needs to keep pace with building

Teams can build and release agents quickly. The set of agents approved this quarter will not be the set running next quarter, so oversight has to work as a standing practice that sees each new agent and each significant change, not a one-off sign-off of the platform.

Questions worth putting to management

  • Who is accountable for each agent built on Vertex AI Agent Builder, and is there a complete list of them?
  • Which agents deal directly with customers or make decisions that affect people, and how is their work reviewed?
  • What limits are set on what each agent can do, and who acts when an agent goes beyond them?
  • What personal information do agents remember, and for how long?
  • How is a new agent or a significant change approved before it goes live?
  • If a regulator, customer or insurer asked how these agents are governed, what would be shown to them?

What good reporting looks like

Expect regular reporting on how many agents are live and what each one does, which ones affect customers or staff, the main risks and how they are moving, any incidents, near misses or limits crossed and the significant approvals given, with who made them and why.

How Aicura can help

  • One register of every agent built on Vertex AI Agent Builder, with a designated owner, an accountable executive and a technical contact for each.
  • Requests for new agents and significant changes routed to the right approvers, with committee decisions recorded against the charter in force.
  • Board reports drafted from the governance record, covering the agent estate, risks, incidents and decisions taken.

For risk, compliance and assurance

Set where agents sit in the risk appetite

Decide which classes of information agents may handle, which decisions they may make alone and which need a person to approve. Agents that deal directly with the public, affect access to services or handle sensitive personal information sit higher on the scale and warrant closer review of their output and a clear path for people to reach a human.

Assess each agent on its own terms

Assessing the platform once is not enough. Assess each agent for the data it reaches, the tools and systems it can act on, the people it affects, how far it acts without review and who is accountable. Agents that call other agents need the whole chain considered, since an action can travel further than any single agent’s purpose suggests.

Reassess when an agent changes

A new tool, a new connection, a change to the underlying AI, a wider audience or a change in how much an agent may do alone all move it away from what was assessed. Each needs to trigger a fresh assessment before it goes live rather than wait for the annual cycle.

Make the data decisions explicitly

Decide whether agents may keep long-term memory about people, what it may contain and how long it is kept. Decide whether prompts and responses are captured in traces and logs, who may see them and for what purpose, and put the notices and consents in place that this requires. Decide which regions agent data may be processed and stored in.

Confirm which protections apply

Check which vendor data commitments apply to the organisation’s Google Cloud accounts and to the AI the agents use, including how inputs and outputs may be used and retained. Where agents call third-party tools, MCP servers or AI services, confirm what each of those providers does with the data passed to them.

Set limits and name who acts

Agree the limits that matter for each agent, such as actions taken per hour, calls to tools that change or delete records, content flagged by screening and sudden changes in spend or behaviour. Name the person who acts when a limit is crossed and agree in advance when an agent is paused.

Be ready to show governance to others

  • Policy. Maintain an AI policy that covers building and running agents, including who may build and release them, what they may do without review and how output affecting people is checked. Tie each commitment to the control that carries it out.
  • Accountability. Record approvals, ownership and changes to each agent with their reasons. Have agent owners confirm periodically that their agents still match what was approved.
  • Operating evidence. Keep records that controls ran, such as completed assessments, release approvals, evaluation results, screening events and interventions.
  • External scrutiny. Prepare for internal and external audit, certification against standards such as ISO/IEC 42001, regulator enquiries and insurer questions about autonomous agents.
  • Customers and partners. People interacting with an agent may need to be told it is AI and how decisions about them are made. Have model cards and decision disclosures ready for the agents that face them.
  • Incidents. Be able to reconstruct which agent version, which tools, which data and which controls were in place when something went wrong.

How Aicura can help

  • Risk and impact assessments for each agent against ISO/IEC 42001 and the NIST AI RMF, run again whenever the agent materially changes, feeding a versioned set of risks and controls that can mirror to the GRC platform.
  • Model cards and decision disclosures drafted from the register for review and reopened when an agent changes.
  • Limits on agent activity with responses the organisation chooses, from notifying the owner and re-running an assessment to re-scoping, quarantining or stopping an agent.
  • Approvals, owner attestations and enforcement events recorded as they happen and gathered into evidence packs a third party can verify without relying on the organisation’s word.

For technology and security

Discover every agent and what sits behind it

Inventory every agent across all Google Cloud projects, including agents built in code, agents built visually, agents deployed outside the managed runtime and agents built from samples. Record for each one the AI it runs on, the tools and MCP servers it can call, the other agents it talks to and the identity it runs under. Vertex AI Agent Builder includes a central registry of agents, MCP servers and tools, which makes a useful source to reconcile against the organisation’s own register.

Give every agent its own identity

Vertex AI Agent Builder can give each deployed agent a unique identity rather than a shared service account. Use that, grant each identity only what its agent needs and keep a record of which identity belongs to which agent, so that access can be reviewed and revoked agent by agent.

Put agent releases under change control

Agents can be deployed from source, from a code repository or through infrastructure as code tooling in a pipeline. Keep agent definitions in source control and run a preflight check on every deployment, rollback and retirement, so a new agent, tool, MCP server or model is checked against agreed rules before it goes live.

Control which tools each agent can reach

Access policies can link an agent’s identity to approved tools, agents and endpoints, with connections blocked unless explicitly allowed and conditions that separate read-only from destructive actions. Limit who can change these policies and who can register new tools and MCP servers, and review each agent’s grants before it is switched on.

Govern traffic in the request path

Vertex AI Agent Builder includes a managed gateway for traffic into and out of agents, with content screening for prompt injection and sensitive data in prompts and tool responses. Use it as the baseline. Because the organisation writes the agent code, calls to AI and tools can also pass through an organisation-run AI gateway on the way to their usual endpoints. That makes it possible to redact personal information before it leaves, screen inbound content for injected instructions, limit agents to approved tools and models, confirm an approved system prompt, cap spend and stop an agent when needed.

Use network controls for what the gateway cannot reach

Processing inside Google’s managed services runs in the vendor’s cloud. Use the organisation’s network perimeter and cloud controls to keep agents and their data within approved projects and regions and to limit where agent traffic may go.

Feed what agents expose into monitoring

Agents on the managed runtime write to Cloud Logging and produce traces through OpenTelemetry, with prompt and response capture available as an explicit choice. Bring those logs and traces into monitoring, flag tool calls an agent was never declared to make, apply the limits risk has agreed and set responses from alerting the owner to revoking an agent’s identity.

Test agents against the live deployment

Vertex AI Agent Builder supports offline and online evaluation of agent quality, including whole conversations. Use it alongside red-teaming and vulnerability scanning of the deployed agent with its real tools and data, before release and on a schedule afterwards, and watch for changes in behaviour between runs.

How Aicura can help

  • One inventory of agents built on Vertex AI Agent Builder, with the models, tools, MCP servers and runtime identities behind each, and discovery of unregistered agents from Google Cloud inventories and code repositories.
  • Preflight checks in the deployment pipeline before an agent is deployed, rolled back or retired, or a tool or model is enabled.
  • An AI gateway in the request path for agent calls, with guardrails derived from the agreed controls covering redaction, injection screening, tool and model limits, approved system prompts, budgets and the ability to stop an agent.
  • A collector inside the network for agent logs and OpenTelemetry traces, plus scheduled red-teaming, evals and agent evals against the live deployment.

Getting lasting value from Vertex AI Agent Builder

Vertex AI Agent Builder pays off when agents are governed as an ongoing practice rather than approved once and left to run. Three things matter whatever the role. The first is knowing every agent in use, what it can reach and who is accountable for it. The second is keeping limits, assessments and controls in step as agents gain tools, connections and independence. The third is being able to show, at any time, how each agent was approved and that its controls held. Organisations that get these right can hand agents more of the work, with confidence rather than caution.

Sources

More AI product guidance

Related guides

In the platform

Register Vertex AI Agent Builder with the rest of your AI

Aicura's AI register and discovery are free to start. Register Vertex AI Agent Builder from a catalogue of known AI products, give it an owner and find the AI nobody has registered yet.

Sign upContact us